Sasser infected HP F1703

  • Thread starter Thread starter Fred R. Gramcko
  • Start date Start date
F

Fred R. Gramcko

Sasser is so bad that I can't keep the computer from
shutting down long enough to even search for the download,
never mind download it and install it.
I need the patch KB835732 on CD.

Please help, I wasted one hour and twenty minutes on hold
for Microsoft Tech support, no help from Microsoft!
 
-----Original Message-----
Sasser is so bad that I can't keep the computer from
shutting down long enough to even search for the download,
never mind download it and install it.
I need the patch KB835732 on CD.

Please help, I wasted one hour and twenty minutes on hold
for Microsoft Tech support, no help from Microsoft!
.
Click to expand...

To stay on-line long enough to get the necessary
updates, patches,
and removal tools, click Start > Run, and
enter "shutdown -a" when the
next RPC countdown begins. This will abort the shut
down. Also, make
sure you've enabled a firewall before starting, to
preclude any more
intrusions while getting the updates/patches/tools.
 
After you boot up, I'll assume that the message that your computer will shut down in XX amount of seconds appears

While it is counting down - do this: go to Start > Run > type in "shutdown -a" and hit O

It will cancel out the countdown and you can download and install the patch

After you have the patch - go to: http://vil.nai.com/vil/stinger/ and get the small Stinger program. Download and run it and it will clean off the Sasser for you

It worked for me - Randy
 
Fred,

Sasser is so bad that I can't keep the computer from
shutting down long enough to even search for the download,
never mind download it and install it.
I need the patch KB835732 on CD.

Please help, I wasted one hour and twenty minutes on hold
for Microsoft Tech support, no help from Microsoft!
Click to expand...


Go to Start > run and type
shutdown -a
this will stop the shutdown and give you time to download the update.

What You Should Know About the Sasser Worm and Its Variants
http://www.microsoft.com/security/incident/sasser.asp

PSS Security Response Team Alert - New Worm Sasser
http://www.microsoft.com/technet/Security/alerts/sasser.mspx


Mitigation Steps for Affected Computers
If your computer is infected with the W32.Sasser.worm,
please do the following:

Enable the Windows XP Internet Connection Firewall or a
third-party firewall on the affected computer.
Disconnect the computer from the Internet.
Restart the computer. If you have problems rebooting,
reboot in safe mode.
Press CTRL+ALT+DEL.
Click the Task Manager.
Click the Processes tab.
Press and hold the CTRL key and then click
C:\WINDOWS\avserve.exe and c:\WINDOWS\system32\*_up.exe.
Click the End Task button.
Click Start.
Click Search and then search for and delete the following
files:
C:\WINDOWS\avserve.exe
C:\WINDOWS\system32\*_up.exe
Click Start again, click Run, and then type: regedit32
Click OK.
In Registry Editor, locate and delete the following
registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersi
on\Run "avserve.exe" = C:\WINDOWS\avserve.exe
Connect the computer to the Internet.
Go to the Windows Update site, and click the Scan for
Updates button.
Download and install the critical updates recommended
after the scan.



http://www.microsoft.com/security/incident/sasser.asp
The stinger tool may also be helpful in detecting and
cleaning the Sasser worm.
http://vil.nai.com/vil/stinger/

Download this update
Microsoft Security Bulletin MS04-011
Security Update for Microsoft Windows (835732)
http://www.microsoft.com/technet/security/bulletin/MS04-011.mspx

Enable your firewall.

MORE ON SECURITY:

Three steps you can take to improve your computer's security:
http://www.microsoft.com/security/protect/

321050 Description of a Personal Firewall
http://support.microsoft.com/?id=321050

More info:

http://securityresponse.symantec.com/avcenter/venc/data/w32.sasser.

worm.html
http://www.bullguard.com/antivirus/vit_randon_i.aspx
http://www.vsantivirus.com/sasser-a.htm

Good luck
 
Back
Top